United States District Court, D. Minnesota
In re: Target Corporation Customer Data Security Breach Litigation, This document relates to: Consumer Cases
[Copyrighted Material Omitted]
For Plaintiff's Lead Counsel, Plaintiff: Charles S Zimmerman, Brian C Gudmundson, LEAD ATTORNEYS, Zimmerman Reed, PLLP, Minneapolis, MN; Felipe J Arroyo, LEAD ATTORNEY, PRO HAC VICE, Robbins Arroyo LLP, San Diego, CA; Karl L Cambronne, LEAD ATTORNEY, Bryan L Bleichner, Chestnut Cambronne, PA, Mpls, MN; Vincent J Esades, LEAD ATTORNEY, Heins Mills & Olson, PLC, Mpls, MN; James J Pizzirusso, Hausfeld LLP, Washington, DC; Jennifer J Sosa, Milberg LLP, New York, NY.
For Plaintiff's Liaison Counsel, Plaintiff: Christopher R Walsh, LEAD ATTORNEY, Walsh Law Firm, Mpls, MN; E Michelle Drake, LEAD ATTORNEY, Nichols Kaster, PLLP, Mpls, MN; Garrett D Blanchfield, Jr, LEAD ATTORNEY, Reinhardt Wendorf & Blanchfield, St Paul, MN; Karen Hanson Riebel, LEAD ATTORNEY, Lockridge Grindal Nauen PLLP, Mpls, MN; Amanda R Cefalu, Anderson, Helgen, Davis & Nissen, LLC, Minneapolis, MN; Jennifer J Sosa, Milberg LLP, New York, NY.
For Target Corporation, Defendant: Douglas H Meal, LEAD ATTORNEY, Ropes & Gray LLP, Boston, MA; Michael A Ponto, Wendy J Wildung, LEAD ATTORNEYS, Faegre Baker Daniels LLP, Mpls, MN; David F McDowell, PRO HAC VICE, David Frank McDowell, Nancy R Thomas, Morrison & Foerster LLP, Los Angeles, CA; Fred B Burnside, DAVIS WRIGHT TREMAINE (SEA), SEATTLE, WA; Harold J McElhinny, Jack W Londen, Rebekah Kaufman, PRO HAC VICE, Samuel James Boone Lunier, Morrison & Foerster LLP, San Francisco, CA; Michael John Agoglia, Morrison & Foerster, San Francisco, CA; Michelle L Visser, Ropes & Gray LLP, San Fransisco, CA; Patrick J. Kenny, ARMSTRONG TEASDALE, LLP, St. Louis, MO; Robert G. Flanders, Jr, Jr., Hinckley, Allen & Snyder LLP, Providence, RI; Sterling Arthur Brennan, MASHOFF BRENNAN, IRVINE, CA.
For Target.com, Defendant: Douglas H Meal, LEAD ATTORNEY, Ropes & Gray LLP, Boston, MA; Michael John Agoglia, LEAD ATTORNEY, Morrison & Foerster, San Francisco, CA; Michael A Ponto, Wendy J Wildung, LEAD ATTORNEYS, Faegre Baker Daniels LLP, Mpls, MN; David F McDowell, PRO HAC VICE, Morrison & Foerster LLP, Los Angeles, CA; Harold J McElhinny, Jack W Londen, Rebekah Kaufman, PRO HAC VICE, Morrison & Foerster LLP, San Francisco, CA.
For Target Corporation of Minnesota, Defendant: Douglas H Meal, LEAD ATTORNEY, Ropes & Gray LLP, Boston, MA; Michael A Ponto, Wendy J Wildung, LEAD ATTORNEYS, Faegre Baker Daniels LLP, Mpls, MN; David F McDowell, PRO HAC VICE, Morrison & Foerster LLP, Los Angeles, CA; Michelle L Visser, Ropes & Gray LLP, San Fransisco, CA; Rebekah Kaufman, PRO HAC VICE, Morrison & Foerster LLP, San Francisco, CA; Seth A. Schmeeckle, Lugenbuhl, Wheaton, Peck, Rankin & Hubbard, New Orleans, LA.
For Target Corporation of Minnesota, Inc., Target.com, Defendants: Douglas H Meal, LEAD ATTORNEY, Ropes & Gray LLP, Boston, MA; Michelle L Visser, Ropes & Gray LLP, San Fransisco, CA; Rebekah Kaufman, Morrison & Foerster LLP, San Francisco, CA; Wendy J Wildung, Faegre Baker Daniels LLP, Mpls, MN.
MEMORANDUM AND ORDER
Paul A. Magnuson, United States District Judge.
This matter is before the Court on Defendant Target Corporation's Motion to Dismiss the Consumer Plaintiffs' First Amended Consolidated Class Action Complaint (Docket No. 258) in the Consumer Cases. For the reasons that follow, the Motion is granted in part and denied in part.
This case arises out of one of the largest breaches of payment-card security in United States retail history: over a period of more than three weeks during the 2013 holiday shopping season, computer hackers stole credit- and debit-card information and other personal information for approximately 110 million customers of Target's retail stores. Plaintiffs are a putative class of consumers who used their credit or debit cards at Target stores during the period of the security breach, and whose personal financial information was compromised as a result of the breach. Indeed,
many of the 114 named Plaintiffs allege that they actually incurred unauthorized charges; lost access to their accounts; and/or were forced to pay sums such as late fees, card-replacement fees, and credit monitoring costs because the hackers misused their personal financial information.
The Judicial Panel on Multidistrict Litigation consolidated all federal litigation into this case, which is divided into two tracks: one for cases brought by financial institutions and one for cases brought by consumers. In this Motion, Target asks the Court to dismiss the First Amended Consolidated Class Action Complaint filed in the consumer cases.
Plaintiffs' Complaint raises seven claims. Count One contends that Target violated the consumer protection laws of 49 states (all states save Alaska) and the District of Columbia. Count Two alleges a similar violation with respect to the data breach statutes of 38 states. Count III asserts that Target was negligent in failing to safeguard its customers' data. Count IV raises a claim for breach of an implied contract as to Plaintiffs who were not Target REDcard cardholders, and Count V claims a breach of contract as to Plaintiffs who were Target REDcard cardholders. Count VI claims a bailment, and Count VII claims unjust enrichment. Target seeks dismissal of all claims, contending that the 121-page, 356-paragraph Complaint lacks sufficient detail to support Plaintiffs' allegations. Cf. Fed.R.Civ.P. 8(a)(2) (requiring a " short and plain statement of the claim" ).
When evaluating a motion to dismiss under Rule 12(b)(6), the Court assumes the facts in the Complaint to be true and construes all reasonable inferences from those facts in the light most favorable to Plaintiffs. Morton v. Becker, 793 F.2d 185, 187 (8th Cir. 1986) . However, the Court need not accept as true wholly conclusory allegations, Hanten v. Sch. Dist. of Riverview Gardens, 183 F.3d 799, 805 (8th Cir. 1999), or legal conclusions that Plaintiffs draw from the facts pled. Westcott v. City of Omaha, 901 F.2d 1486, 1488 (8th Cir. 1990).
To survive a motion to dismiss, a complaint must contain " enough facts to state a claim to relief that is plausible on its face." Bell A. Corp. v. Twombly, 550 U.S. 544, 545, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). Although a complaint need not contain " detailed factual allegations," it must contain facts with enough specificity " to raise a right to relief above the speculative level." Id. at 555. " Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements," will not pass muster under Twombly. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (citing Twombly, 550 U.S. at 555). In sum, this standard " calls for enough fact[s] to raise a reasonable expectation that discovery will reveal evidence of [the claim]." Twombly, 550 U.S. at 556.
Target's primary argument is that Plaintiffs do not have standing to raise any of their claims because Plaintiffs cannot establish injury. A plaintiff invoking the Article III jurisdiction of the federal courts must establish that he or she has standing to do so. That is, the plaintiff " must have suffered an 'injury in fact'--an invasion of a legally protected interest which is (a) concrete and particularized . . . and (b) actual or imminent, not conjectural
or hypothetical." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (internal citations and quotation marks omitted). Target contends that Plaintiffs' claimed injuries are not actual or imminent, and as such do not suffice to give them standing to sue.
But Plaintiffs have alleged injury. Indeed, paragraphs 1.a through 1.g and 8 through 94 of the Complaint are a recitation of many of the individual named Plaintiffs' injuries, including unlawful charges, restricted or blocked access to bank accounts, inability to pay other bills, and late payment charges or new card fees. Target ignores much of what is pled, instead contending that because some Plaintiffs do not allege that their expenses were unreimbursed or say whether they or their bank closed their accounts, Plaintiffs have insufficiently alleged injury. These arguments gloss over the actual allegations made and set a too-high standard for Plaintiffs to meet at the motion-to-dismiss stage. Plaintiffs' allegations plausibly allege that they suffered injuries that are " fairly traceable" to Target's conduct. Allen v. Wright, 468 U.S. 737, 753, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984), abrogated on other grounds, Lexmark Int'l, Inc. v. Static Control Components, Inc., 134 S.Ct. 1377, 188 L.Ed.2d 392 (2014). This is sufficient at this stage to plead standing. Should discovery fail to bear out Plaintiffs' allegations, Target may move for summary judgment on the issue.
2. State Claims
Target also argues that because none of the 114 named Plaintiffs hails from five jurisdictions--Delaware, Maine, Rhode Island, Wyoming, or the District of Columbia--claims under the laws of those jurisdictions should be dismissed for lack of standing. Plaintiffs contend that this determination is premature, but ask in the alternative that the Court permit them to amend to add Plaintiffs from these jurisdictions if the Court is inclined to agree with Target.
There is a significant split of authority as to whether a court should address the standing of named plaintiffs at the motion-to-dismiss stage or at the class-certification stage. Another Judge in this District recently decided that the issue is best addressed at the motion-to-dismiss stage, and she dismissed for lack of standing state-law claims for states in which no named plaintiff resided. Insulate SB, Inc. v. Advanced Finishing Sys., Inc., Civ. No. 13-2664, 2014 WL 943224 (D. Minn. Mar. 11, 2014) (Montgomery, J.). Target urges the Court to follow this opinion and dismiss the claims from jurisdictions in which there is currently no named Plaintiff.
Insulate was an antitrust putative class action with a single named plaintiff, a California-resident corporation. Insulate's complaint raised claims for violations of other state's laws, and the defendants moved to dismiss contending that Insulate lacked standing to assert state-law claims for states other than California. Id. at *10. Insulate argued, as Plaintiffs do here, that the standing issue was not ripe for decision until after the class-certification stage. Id.
Judge Montgomery noted that the split among courts regarding the proper time to evaluate a named plaintiff's standing
stems from the two Supreme Court cases of Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997), and Ortiz v. Fibreboard Corp., 527 U.S. 815, 119 S.Ct. 2295, 144 L.Ed.2d 715 (1999). Both cases concern global settlements of class actions, address the standing of absent class members (rather than named plaintiffs) and involve situations in which the court was simultaneously presented
with class certification issues and Article III issues. In each case, the Supreme Court resolved class certification issues prior to resolving Article III standing, because the class certification issues were dispositive in those cases and thus were " logically antecedent to the existence of Article III issues."
Id. (quoting Amchem, 521 U.S. at 591-92) (internal citations omitted). Although some courts interpreted these decisions to require deferral of the Article III standing determination until after class certification, Judge Montgomery found more persuasive the decisions that interpreted the Supreme Court precedent to allow consideration of the named plaintiff's Article III standing at an earlier stage, thus requiring " a named plaintiff to establish standing for each claim set forth in a class action when the issue is presented prior to class certification." [Wl] at *11.
Although standing is a " threshold issue" usually considered at the outset of the case, Arkansas Right to Life State Political Action Comm. v. Butler, 146 F.3d 558, 560 (8th Cir. 1998), the Supreme Court's Amchem and Ortiz decisions make clear that there are situations in which a court may defer that issue to later in the case. Moreover, at the motion-to-dismiss stage, Plaintiffs need only plausibly allege that they can establish the elements of standing. See Lujan, 504 U.S. at 561 (noting that the elements of standing must be supported " with the manner and degree of evidence required at the successive stages of the litigation" ). Plaintiffs have plausibly alleged that they have standing to represent a class of individuals in every state and the District of Columbia, and thus that they have standing to raise state-law claims in those jurisdictions.
In addition, there is an important difference between Insulate and the cases on which Insulate relied and this case. Insulate and the other cases holding that standing should be determined before class certification are antitrust cases, in which " 'the constitutional and prudential requirements of standing take on particular significance.'" In re Ductile Iron Pipe Fittings Indirect Purchaser Antitrust Litig., Civ. No. 12-169, 2013 WL 5503308, at *9 (D.N.J. Oct. 2, 2013) (quoting City of Pittsburgh v. W. Penn Power Co., 147 F.3d 256, 264 (3d Cir. 1998)). The instant case, on the other hand, contains no antitrust allegations, and thus there is no " particular significance" to the standing determination. And unlike Insulate, this is not a case where a single named plaintiff asserts the laws of a multitude of states in which that plaintiff does not reside. Rather, there are 114 named Plaintiffs who reside in every state in the union save four and the District of Columbia. The standing concerns present in Insulate and other antitrust cases are simply not present here.
As Target undoubtedly knows, there are consumers in Delaware, Maine, Rhode Island, Wyoming, and the District of Columbia whose personal financial information was stolen in the 2013 breach. To force Plaintiffs' attorneys to search out those individuals at this stage serves no useful purpose. In this case, and under the specific facts presented here, the Article III standing analysis is best left to after the class-certification stage. Should a class be certified, and should that class as certified contain no members from certain states, Target may renew its arguments regarding standing.
3. Injunctive Relief
Finally, Target contends that Plaintiffs lack standing to seek injunctive relief because they do not allege that they face a threat of ongoing or future harm that is certainly impending. The Prayer for Relief seeks " appropriate injunctive relief" including an order that Target encrypt all customer data from the point of sale through Target's payment system, comply with federal and Minnesota law regarding data security and the retention of data, adopt EMV chip technology for Target-issued credit and debit cards, and requiring Target to provide extended credit-monitoring services to Plaintiffs and class members. (Compl. at 121-22, ¶ C.)
To establish " injury in fact" for purposes of injunctive relief, a plaintiff must show that he " faces a threat of ongoing or future harm." Park v. U.S. Forest Serv., 205 F.3d 1034, 1037 (8th Cir. 2000). " [I]t is the plaintiff's burden to establish standing by demonstrating that, if unchecked by the litigation, the defendant's allegedly wrongful behavior will likely occur or continue, and that the threatened injury is certainly impending." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., Inc., 528 U.S. 167, 190, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) (internal alterations and quotations omitted).
Target's arguments regarding Plaintiffs' standing are premature. Plaintiffs have plausibly pled that their injuries will be redressed by the injunctive relief they seek, and at this stage, that is all that is required. The cases on which Target relies determined the injunctive-relief standing issue at the summary-judgment stage, not the motion-to-dismiss stage. As the Supreme Court itself has noted, even attenuated injuries are sufficient to confer Article III standing at the motion-to-dismiss stage. Whitmore v. Arkansas, 495 U.S. 149, 158, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990) (discussing United States v. SCRAP, 412 U.S. 669, 93 S.Ct. 2405, 37 L.Ed.2d 254 (1973)). In SCRAP, the plaintiff environmental group alleged that a surcharge on railroad freight rates would cause the group's members to suffer " economic, recreational and aesthetic harm" because it would increase the use of nonrecyclable goods, and thereby increase the use of natural resources to produce more goods, resulting in more garbage in Washington-area parks. SCRAP, 412 U.S. at 678. The Supreme Court determined that even these thin allegations were " sufficient to survive a motion to dismiss for lack of standing."
Whitmore, 495 U.S. at 159. The Court indicated, however, that summary judgment on standing might be appropriate if discovery revealed that " the allegations were sham and raised no genuine issue of fact."
SCRAP, 412 U.S. at 689 & n.15.
Plaintiffs' plausible allegations are certainly more substantial than those in SCRAP. Those allegations, taken as true, establish Plaintiffs' standing to seek injunctive relief. Whether discovery will bear out those allegations is a matter for another day. Target's Motion on this point is denied.
B. Consumer Protection Laws
Target first contends that Plaintiffs have failed to state a claim under any jurisdiction's deceptive trade practices statutes. As noted, the Complaint raises claims under the laws of 49 states and the District of Columbia. (Compl. ¶ 263.) Plaintiffs
contend that Target violated these consumer protection laws in several ways:
. by " fail[ing] to maintain adequate computer systems and data security practices; "
. by " fail[ing] to disclose the material fact that it did not have adequate computer systems and safeguards to adequately protect customers' personal and financial information; "
. by " fail[ing] to provide timely and accurate notice to [Plaintiffs] of the material fact of the Target data breach; " and
. by continuing to " accept [Plaintiffs'] credit and debit card payments for purchases at Target after Target knew or should have known of that data breach and before it purged its systems of the hackers' malware."
Target contends that Plaintiffs have failed to allege economic injury, as the consumer protection laws in 26 of the 50 jurisdictions require. But Plaintiffs have pled economic injury, in the form of unreimbursed late fees, new card fees, and other charges. Regardless whether Plaintiffs have sufficiently pled economic injuries, however, the law is not as clear on this issue as Target argues. Although some states' statutes provide that a plaintiff may recover only for " ascertainable loss," that phrase is in general not limited to only purely economic loss, and includes other damages like loss of prospective customers, Serv. Rd. Corp. v. Quinn, 241 Conn. 630, 698 A.2d 258, 265 (Conn. 1997), or failure to provide exclusivity with regard to an art collection, Feitler v The Animation Celection, Inc., 170 Or.App. 702, 13 P.3d 1044, 1050 (Or. Ct. App. 2000).
There are several jurisdictions, such as Wisconsin, in which the consumer protection statutes require " pecuniary loss." Wis. Stat. § 100.20. Plaintiffs argue that courts in these states have required a " liberal construction" of these statutes, but a court cannot liberally construe a pecuniary-loss requirement to include non-pecuniary losses. Because Plaintiffs have plausibly alleged pecuniary loss, however, they have stated a claim even under state laws that require such loss.
Plaintiffs have plausibly pled injury sufficient to meet the loss requirements in each of the jurisdictions from which their consumer protection claims stem. The determination whether all of the injuries Plaintiffs claim (Compl. ¶ 262) are cognizable under each state's consumer-protection laws is a matter for summary judgment, not a motion to dismiss.
2. Duty to Disclose
Target next argues that 18 states do not recognize a violation of consumer-protection statutes for omissions unless there was a duty to disclose. According to Target, Plaintiffs have failed to plead a duty to disclose. In addition, Target contends that Plaintiffs must plead their omission-based consumer-protection claims under Rule 9(b)'s specific pleading requirements. Because of Plaintiffs' alleged failure to plead with particularity, Target contends that Plaintiffs' claims under nine states' statutes--California, Delaware, Kansas, Maryland, Minnesota, New Mexico, Nevada, Pennsylvania, and Texas--should be dismissed, and that portion of Plaintiffs' claims based on deceptive conduct should be dismissed as to the other nine states' statutes -- Arizona, California,
Connecticut, Hawaii, Idaho, Louisiana, Michigan, Oklahoma, and Washington.
Plaintiffs allege that Target knew that its customers' data was sensitive and should be protected, knew that its systems were inadequate to protect that data, and continued to accept credit and debit cards after it knew or should have known that the systems were susceptible to breach or had been breached. (Compl. ¶ ¶ 233-37.) Target argues that these allegations are insufficient to establish a duty.
Neither party has provided the Court with any legal authority regarding the type of allegations that are sufficient to establish a duty to disclose under a state consumer-protection statute. In the absence of such authority, Plaintiffs' plausible allegations, taken as true, establish with sufficient ...